Clop-linked Windchill web shell decrypts credentials and maps engineering data.

A sophisticated, custom-built JavaServer Pages (JSP) web shell has been discovered deployed by threat actors targeting critical vulnerabilities in PTC Windchill and FlexPLM servers. Cybersecurity firm ReliaQuest has detailed how this bespoke tool, specifically crafted for Product Lifecycle Management (PLM) software, acts as a powerful extortion platform, enabling extensive data theft and remote…